High level description

With the rising popularity of AI agents, Anthropic has developed a new protocol for LLM models to communicate with tools. The Model Context Protocol (MCP) is slowly becoming a standard for developing tools for LLMs and LLM Agents. In MCP there are no security or authentication methods, so exposing tools towards end users can be harmful or risk exposing data.

This thesis aims to investigate security and authentication solutions for MCP and implement a POC on how we can expose external tools to end users without the risk of leaking data.

Who are we looking for?

Bachelor/Master of Science in Computer Science/Engineering

Project description

This thesis aims to investigate how MCP can be secured and exposed to external users. The investigation should end in the development of a POC where an AI Agent can call tools with the security context of the current user and only expose data accessible to the user.

Purpose and Scope

In this thesis investigate these questions:

• Are there current solutions for MCP security?
• Can MCP be extended with security or is a new protocol required?
• Can the MCP standard be extend with authentication?
• What are the limits of securing tool calling for an LLM?

References:

MCP, https://modelcontextprotocol.io

Quarkus MCP Lib, https://docs.quarkiverse.io/quarkus-mcp-server/dev/index.html#

Awesome MCP, https://github.com/punkpeye/awesome-mcp-servers

An Exciting Journey with Knightec Group
Semcon and Knightec have joined forces as Knightec Group. Together, we are Northern Europe’s leading strategic partner in product and digital service development. With a unique combination of cross-functional expertise and a holistic business understanding, we help our clients realize their strategies – from idea to complete solution.

Practical Information
This is a thesis position, located at our office in Sundsvall. Start date January or March 2026.

Please submit your application as soon as possible, but no later than 2025-11-30. If you have any questions, you are welcome to contact Johanna Edström. Note that due to GDPR, we only accept applications through our careers page.